Rotorcraft autopilot and methods

ABSTRACT

A helicopter autopilot system includes an inner loop for attitude hold for the flight of the helicopter including a given level of redundancy applied to the inner loop. An outer loop is configured for providing a navigation function with respect to the flight of the helicopter including a different level of redundancy than the inner loop. An actuator provides a braking force on a linkage that serves to stabilize the flight of the helicopter during a power failure. The actuator is electromechanical and receives electrical drive signals to provide automatic flight control of the helicopter without requiring a hydraulic assistance system in the helicopter. The autopilot can operate the helicopter in a failed mode of the hydraulic assistance system. A number of flight modes are described with associated sensor inputs including rate based and true attitude modes.

RELATED APPLICATIONS

This application is a continuation application of copending U.S. patentapplication Ser. No. 16/510,897, filed on Jul. 13, 2019, which is acontinuation application of U.S. patent application Ser. No. 15/687,454,filed on Aug. 26, 2017 and issued as U.S. Pat. No. 10,351,231 on Jul.16, 2019, which is a divisional application of U.S. patent applicationSer. No. 15/015,689 filed on Feb. 4, 2016 and issued as U.S. Pat. No.9,758,244 on Sep. 12, 2017, which is a divisional application of U.S.patent application Ser. No. 13/763,574 filed on Feb. 8, 2013 and issuedas U.S. Pat. No. 9,272,780 on Mar. 1, 2016, which claims priority fromU.S. Provisional Patent Application Ser. No. 61/597,555 filed on Feb.10, 2012; U.S. Provisional Patent Application Ser. No. 61/597,570 filedon Feb. 10, 2012; and U.S. Provisional Patent Application Ser. No.61/597,581 filed on Feb. 10, 2012. All of the above referencedapplications are hereby incorporated by reference in their entirety.

BACKGROUND

The present application is generally related to flight control systemsand, more particularly, to a rotorcraft autopilot and associatedmethods.

A helicopter is inherently unstable, generally requiring that the pilotmaintain a constant interaction with the cyclic control using one hand.Even a momentary release of the cyclic can result in the cyclic orcontrol stick “flopping over”, accompanied by a loss of control of thehelicopter. This is particularly inconvenient when the pilot has a needto engage in hands-free activities such as, for example, adjusting aheadset or referring to a hardcopy of a map. Further, the need toconstantly control the cyclic can result in pilot fatigue.

Traditional autopilots can provide benefits which include allowing thepilot to release the cyclic to engage in hands-free tasks, as well asreducing pilot fatigue. Applicants recognize, however, that the cost ofa traditional helicopter autopilot can be prohibitive. For example, thecost can be so significant in comparison to the cost of the helicopteritself that autopilots are uncommon in light helicopters.

The foregoing examples of the related art and limitations relatedtherewith are intended to be illustrative and not exclusive. Otherlimitations of the related art will become apparent to those of skill inthe art upon a reading of the specification and a study of the drawings.

SUMMARY

The following embodiments and aspects thereof are described andillustrated in conjunction with systems, tools and methods which aremeant to be exemplary and illustrative, not limiting in scope. Invarious embodiments, one or more of the above-described problems havebeen reduced or eliminated, while other embodiments are directed toother improvements.

Generally, an autopilot system for a helicopter, associated components,and methods are described. In one aspect of the disclosure, an innerloop is configured at least for providing a true attitude for the flightof the helicopter including a given level of redundancy applied to theinner loop. An outer, autopilot loop is configured for providing atleast one navigation function with respect to the flight of thehelicopter including a different level of redundancy than the innerloop.

In another aspect of the disclosure an actuator arrangement forms partof an autopilot for providing automatic control of a helicopter byactuating one or more flight controls of the helicopter. At least oneelectric motor includes an output shaft and a motor coil arrangement forreceiving a drive current that produces rotation of the output shaft. Anactuator linkage is operatively coupled between the output shaft of themotor and the flight controls such that rotation of the output shaftproduces a corresponding movement of the actuator linkage and the flightcontrols. A motor drive arrangement is operable to provide the drivecurrent from a power source during normal operation of the autopilot andat least for shorting the motor coil arrangement responsive to a failureof the power source such that the motor provides a braking force on theactuator linkage that serves to stabilize the flight of the helicopterduring the power failure.

In still another aspect of the present disclosure, an embodiment of anautopilot system and associated method are described for a helicopterwhich includes a GPS unit that provides a GPS output. A sensorarrangement is dedicated to the autopilot and produces a set of sensoroutputs to characterize the flight of the helicopter. A controlarrangement receives the GPS output and the sensor outputs and generateselectrical drive signals in response thereto. An actuator iselectromechanical and receives the electrical drive signals to generatemechanical control outputs responsive thereto that are mechanicallycoupled to the helicopter to provide automatic flight control of thehelicopter without requiring a hydraulic system in the helicopter.

In yet another aspect of the present disclosure, an autopilot system andassociated method are described for a helicopter which includes ahydraulic assistance system that receives flight control inputs from apilot and, in turn, produces mechanical outputs that are mechanicallycoupled to the helicopter to provide pilot control of the helicopter. Asensor arrangement produces a set of sensor outputs that characterizethe flight of the helicopter. A control arrangement receives the sensoroutputs and generates electrical drive signals. An actuator arrangementis electromechanical and receives the electrical drive signals togenerate control outputs responsive thereto that are mechanicallycoupled to the hydraulic assistance system and is configured tocooperate with the control arrangement to provide automatic flightcontrol of the helicopter in a first, normal mode with the hydraulicassistance system in a normal operational status and in a second, failedmode with the hydraulic assistance system in a failed operational statusto provide automatic flight control of the helicopter in each of thenormal mode and the failed mode.

In a continuing aspect of the present disclosure, a flight controlsystem and associated method are described for selective automaticcontrol of the forward flight of a helicopter which forward flight ischaracterized by a set of orientation parameters including a pitchorientation, a roll orientation and a yaw orientation. In embodiments, atriaxial MEMS rate sensor is supported by the helicopter for generatinga roll rate signal, a pitch rate signal and a yaw rate signal that areresponsive to changes in said roll orientation, pitch orientation andyaw orientation, respectively. A MEMS triaxial accelerometer generatesaccelerometer signals responsive to the forward flight. A GPS receiveris supported by the helicopter for generating a course signal and aspeed signal responsive to the forward flight of the helicopter. Atriaxial magnetometer generates magnetometer signals. A controllerreceives a set of inputs consisting of the pitch rate signal, the rollrate signal, the yaw rate signal, the accelerometer signals, the coursesignal, the magnetometer signals, and the speed signal to determine atrue attitude of the helicopter and generate a set of control signals tomaintain a stable forward flight orientation of the helicopter accordingto a selected course defined on the ground and a selected speed. Anactuator arrangement receives the set of control signals to adjust theforward flight of the helicopter based on the set of control signals. Inone embodiment, the speed signal can be provided by the GPS. In anotherembodiment, the speed signal can be provided by an aircraft airspeedsensor.

In a further aspect of the present disclosure, a flight control systemand associated method are described for selective automatic control ofthe forward flight of a helicopter which forward flight is characterizedby a set of orientation parameters including a pitch orientation, a rollorientation and a yaw orientation. In embodiments, a triaxial MEMS ratesensor is supported by the helicopter for generating a roll rate signal,a pitch rate signal and a yaw rate signal that are responsive to changesin said roll orientation, pitch orientation and yaw orientation,respectively. A MEMS triaxial accelerometer generates accelerometersignals responsive to the forward flight. A GPS receiver is supported bythe helicopter for generating a course signal, an altitude signal, and aspeed signal responsive to the forward flight of the helicopter. Atriaxial magnetometer generates magnetometer heading signals. Acontroller is supported by the helicopter to receive a set of inputsconsisting of the pitch rate signal, the roll rate signal, the yaw ratesignal, the acceleration signals, the course signal, the altitudesignal, the magnetometer heading signals and the speed signal todetermine a true attitude of the helicopter and to generate a set ofcontrol signals to maintain a stable forward flight orientation of thehelicopter according to a selected course defined on the ground and aselected altitude on the selected course. An actuator arrangementreceives the set of control signals to adjust the forward flight of thehelicopter based on the set of control signals. In one embodiment, thespeed signal and/or the altitude signal can be provided by the GPS. Inanother embodiment, respective ones of the speed signal and/or thealtitude signal can be provided by an aircraft airspeed sensor and/or apressure-based altitude sensor.

In another aspect of the present disclosure, a flight control system andassociated method are described for selective automatic control of theflight of a helicopter that is capable of flying in a hover, which hoveris characterized by a set of orientation parameters including a pitchorientation, a roll orientation, a yaw orientation and a position abovethe ground. In embodiments, a MEMS sensor arrangement is supported bythe helicopter for generating a pitch rate signal that is responsive tochanges in said pitch orientation, a roll rate signal that is responsiveto changes in the roll orientation, a yaw rate signal that is responsiveto said yaw orientation, and acceleration signals responsive to thehover. A magnetometer generates a magnetic heading signal. A GPSreceiver is supported by the helicopter for generating a positionsignal, a speed signal and a course signal responsive to the hover ofthe helicopter. A processing arrangement is supported by the helicopterfor receiving a set of inputs consisting of the pitch rate signal, theroll rate signal, the yaw rate signal, the acceleration signals, theposition signal, the speed signal, the course signal, and the magneticheading signal to determine a true attitude of the helicopter and togenerate a set of control signals to maintain a stable hover of thehelicopter according to a selected hovering position. An actuatorarrangement for receiving the set of control signals to adjust the hoverof the helicopter based on the set of control signals. In an embodiment,an aircraft pressure-based altitude sensor signal or a GPS-basedaltitude signal can be used to indicate a current offset from a desiredaltitude.

In yet another aspect of the present disclosure, an autopilot system andassociated method are described for a helicopter. An inner loop isconfigured at least for providing a true attitude for the flight of thehelicopter including a given level of redundancy applied to the innerloop. An outer, autopilot loop is configured for providing at least onenavigation function with respect to the flight of the helicopter andwherein the inner loop and the outer loop are each configured withtriplex processors.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments are illustrated in referenced figures of thedrawings. It is intended that the embodiments and figures disclosedherein are to be illustrative rather than limiting.

FIG. 1 is a diagrammatic perspective, partial view of a helicopterincluding components of an autopilot according to the presentdisclosure.

FIG. 2 is an overhead diagrammatic perspective, partial view of thehelicopter of FIG. 1, shown here to illustrate further details withrespect to components of the autopilot system.

FIG. 3 is a diagrammatic, perspective cutaway view of an embodiment ofan actuator and an embodiment of a force limited link that can serve ascomponents of the autopilot of the present disclosure.

FIG. 4 is a diagrammatic, perspective view of an embodiment of a geardrive arrangement that can form part of the actuator of FIG. 3 alongwith a redundant pair of actuator drive motors.

FIG. 5 is a block diagram that illustrates an embodiment of theautopilot of the present disclosure.

FIG. 6 is a schematic diagram of an embodiment of a voting section thatreceives votes which are cast by a set of triplex processors.

FIG. 7 is a flow diagram that illustrates an embodiment of a method forthe operation of an inner control loop and an outer control loop of theautopilot of the present disclosure.

FIG. 8 is a schematic diagram of an embodiment of a dynamic brakingsystem that can form part of the autopilot of the present disclosure.

FIG. 9 is a schematic diagram of another embodiment of a dynamic brakingsystem that can form part of the autopilot of the present disclosure.

FIG. 10 is a block diagram of another embodiment of the autopilot of thepresent disclosure including a fail-functional design configuration thatuses a triplex architecture in both the inner and outer loops.

FIG. 11 is a chart that illustrates autopilot flight modes in terms ofthe various sensor inputs that are employed for control purposes.

DETAILED DESCRIPTION

The following description is presented to enable one of ordinary skillin the art to make and use the invention and is provided in the contextof a patent application and its requirements. Various modifications tothe described embodiments will be readily apparent to those skilled inthe art and the generic principles taught herein may be applied to otherembodiments. Thus, the present invention is not intended to be limitedto the embodiment shown, but is to be accorded the widest scopeconsistent with the principles and features described herein includingmodifications and equivalents. It is noted that the drawings may not beto scale and may be diagrammatic in nature in a way that is thought tobest illustrate features of interest. Descriptive terminology may beadopted for purposes of enhancing the reader's understanding, withrespect to the various views provided in the figures, and is in no wayintended as being limiting.

FIG. 1 is a perspective, partial view of a helicopter 10, shown here forpurposes of illustrating various components of an embodiment of anautopilot system 12 in relation to the helicopter. It should beappreciated that much of the physical structure of the helicopter itselfhas been rendered as invisible in FIG. 1 for purposes of illustrativeclarity, however, it is understood that this structure is present. Theautopilot of the present disclosure is electromechanical and can provideflight control of a helicopter without requiring a hydraulic flightcontrol system. The helicopter can be, by way of non-limiting example, aRobinson R22 helicopter. The teachings that are brought to light herein,however, can readily be adapted for use with any suitable helicopter,either currently available or yet to be developed. For example, theautopilot of the present disclosure can be used with helicopters havinghydraulic cyclic assistance, as will be further described below.

Helicopter 10 includes a stick or cyclic 14 having a control handle orgrip 18 that is configured for engagement with the hand of a pilot. Aswill be appreciated by one of ordinary skill in the art, stick 14 can bemoved fore and aft (toward and away from an instrument console 20) tocontrol pitch of the helicopter and transversely for purposes ofcontrolling roll of the helicopter in a coordinated manner to producecontrolled flight. Additional control inputs are provided by the pilotvia a pair of pedals in order to control the yaw orientation of thehelicopter by changing the pitch of a tail rotor. It is noted that theseyaw orientation control components have not been shown for purposes ofillustrative clarity but are understood to be present. In an embodiment,the pilot also remains in control of the collective of the helicopter aswell as the throttle settings. The autopilot of the present disclosure,however, can exert full control authority over stick 14 by moving thestick in any direction to the limits of its travel under appropriatecircumstances. Stick 14 passes below a deck 24 of the helicopter andengages pitch and roll linkages of the helicopter in a manner that isfamiliar to one of ordinary skill in the art so as to control cyclicactuation of the main rotor of the helicopter. The term “cyclic” refersto the variation in pitch of the rotor blades of the helicopter on a perrevolution basis. In this regard, cyclic control can refer tomanipulation of the stick or the stick itself can be referred to as thecyclic. An autopilot display processor unit (ADPU) 28 can be mounted ininstrument console 20 to provide indications to the pilot as well as toprovide processing capability and other capabilities, as will be furtherdescribed.

The cyclic, in particular, handle 18 includes a Switch Module Assembly26 that can be mounted as shown. Details of handle 18 are shown in afurther enlarged inset view. The switch module can contain switchesincluding an engage/disengage switch 29 a and a trim/mode “top-hat”switch 29 b (4-way). The top-hat switch allows the pilot to trim thecourse, speed, position, and altitude. Depressing the top-hat switch tosimultaneously actuate more than one switch can select a highlightedmode. There can be a time-out feature in the autopilot processor whichprevents switch faults or wiring faults from causing continuoustrimming. The mode switch can select and deselect altitude, speed, hoveror position hold modes based on current flight condition. It is notedthat, for purposes of the present disclosure, a hover mode can bereferred to interchangeably as a position mode hold since there is norequirement imposed herein for the autopilot to control the collectiveof the helicopter and/or the foot pedals.

Still referring to FIG. 1, autopilot 12 implements cyclic controlthrough a number of component assemblies that are appropriately locatedon the helicopter. A main autopilot unit 30 is located below the maindeck of the helicopter. In the present embodiment, main unit 30 includesan L-shaped enclosure 31 that supports electronics as well as a pitchcontrol actuator linkage 32 a and a roll control actuator linkage 32 b,which may be referred to generally or collectively by the referencenumber 32. Each of these linkages includes an actuator that is locatedwithin the main unit enclosure, as will be further described. A distalend of each of the linkages engages the lowermost end of stick 14 toimplement what is known as a parallel control system. In this regard, itshould be appreciated that the original cyclic control linkages ofhelicopter 10 between stick 14 and the rotor remain intact. That is,inputs from the helicopter pilot as well as the autopilot are inputdirectly to the stick. Details with respect to the pitch and rollcontrol linkages provide for a parallel control input arrangement. Aseries type autopilot control system, in contrast, requires breaking theoriginal cyclic control linkages of the helicopter between the stick androtor such that the autopilot actuators can be inserted into the break.It should be appreciated that the teachings herein can readily beadapted to a series control input embodiment.

Turning to FIG. 2, components of the helicopter and autopilot are shownin an overhead perspective view. In this view, a pitch actuator 60 a anda roll actuator 60 b (which may be referred to generally or collectivelyby the reference number 60) can be seen within L-shaped enclosure 31with the lid of the enclosure rendered transparent. Main unitelectronics 66 are located within the enclosure and are suitablyelectrically interfaced (not shown) both externally and to theactuators.

Referring to FIG. 3, an embodiment of actuator 60 that can be used forthe pitch and roll actuators throughout this disclosure is seen in aperspective view installed within enclosure 31 and connected to acontrol linkage 32. Each actuator includes a housing 82 having a geararrangement, yet to be illustrated, within the housing, dual motorsMotor A and Motor B, and a clutch arrangement 84 for selectivelyengaging and disengaging the motors to rotate an output shaft which isnot visible on the opposite side of housing 82. As will be seen, thegear arrangement allows motors A and B to simultaneously drive theoutput shaft or either one of the motors to individually drive theoutput shaft. In the present embodiment, motors A and B are brushless DCmotors having a Y stator winding configuration which requirescoordinated inputs to drive the motor phases in a particular sequence.As such, the motors cannot runaway under their own power. The motorsinclude Hall effect sensors that are used for purposes of timingelectrical drive pulses to the stator of the motor. Further details withrespect to the motors and related drive considerations are provided atone or more appropriate points hereinafter. While the present disclosurehas been framed in terms of the use of brushless DC motors having a Ystator coil by way of example, it should be appreciated that anysuitable type of electric motor can be used.

FIG. 4 illustrates an embodiment of a gear drive arrangement 100 thatcan be used in the actuator of FIG. 3. Initially, it is noted that thegear drive arrangement is a multi-stage reduction drive, for example, onthe order of about 1750:1. Also, teeth have not been illustrated on anumber of the gears to be described, but are understood to be present.Other embodiments may not require gears with teeth. Motors A and B haveoutput shafts supporting gears that engage a gear 102 on a first shaft104. An opposing end of shaft 104 supports a smaller gear 106 thatdrives a gear 110 that is supported on a second shaft 112 which alsosupports a smaller gear 114 (partially hidden in the view of thefigure). It is noted that shaft 112 can comprise a clutch shaft that canmove laterally to selectively engage or disengage the actuator motorsfrom the remaining gears of the gear drive. A suitable clutcharrangement is described, for example, in U.S. Pat. No. 7,954,614 whichis incorporated by reference. The clutch arrangement relies uponmovement of the clutch shaft along its elongation axis by using apermanent magnet that is mounted on a distal end of the shaft. A clutchactuator 113 (FIG. 3) can selectively move (for example, rotate) anotherpermanent magnet in relation to the clutch shaft mounted permanentmagnet such that the clutch shaft is magnetically biased to move betweenan engaged position and a disengaged position. The clutch shaft remainsin a current operational position despite a power failure. Gear 114, inturn, selectively drives a gear 120 that is supported on a third shaft122. The latter also supports a smaller gear 124 that drives a gear 130that is supported on a forth shaft 132. The forth shaft, in turn,supports a smaller gear 134 which is arranged to rotate an output gear140 that is supported on an output shaft 142 of the actuator. The outputgear is configured to provide sufficient rotation to move stick 14through its full range of motion. In an embodiment, the actuators of thepresent disclosure are sufficiently robust, in terms of the generatedlevel of actuation force, so as to be capable of controlling the cyclicof a hydraulically equipped helicopter using a failed hydraulic system.In the present embodiment, the actuator is capable of producing 600inch-pounds or 50 food-pounds of torque. Further, in the presentembodiment, using a 2 inch actuator arm, this provides for thecapability of applying forces of up to 300 pounds to the bottom of thecyclic. While the present embodiment has been designed to provideactuation forces at this level, it should be appreciated that in anotherembodiment, significantly higher or lower forces can be provided byvarying any of: the motor output torque, the gear-train reduction ratio,or the actuator arm length. As seen in FIGS. 1 and 2, the actuatorforces are applied to the bottom of the cyclic whereas pilot forces areapplied to the top of the cyclic. Accordingly, the pilot is providedwith a mechanical advantage due to the different lever-arm lengths. Onthe R22 helicopter, the mechanical advantage that the pilot has at thetop of the stick compared to the bottom of the stick where the actuatorsare attached is roughly 7:1. In such a case, an actuator applied forceof 300 pounds is equivalent to about 43 pounds of pilot applied force.Similarly, while the actuator can generate very large forces, theforce-limited-link that is described below generally will not transmitforces of such a magnitude through to the base of the cyclic, unless amuch stiffer force-limited link is installed.

In an embodiment, the autopilot can determine, based on sensor inputs,the status of the hydraulic control system of the helicopter as one of anormal mode and a failed mode. In the normal mode, the inner loop cangenerate actuator motor control signals based on a first, normal set ofparameters. In the failed mode, the autopilot can generate actuatormotor control signals based on a second, failure set of parameters. Thefailure parameters can address any change in control that is introducedby the loss of hydraulic assistance for purposes of cyclic actuation.For example, compensation for a dead zone or hysteresis zone can beaccommodated. As another example, compensation can be introduced toaccount for limit cycling that can occur in the dead zone such as, forinstance, automated dithering. These parameter sets, among others, canbe stored in appropriate memory that is accessible by the MCPs, as willbe discussed below.

Having described the mechanical components of the autopilot in detailabove, it is now appropriate to describe the autopilot in terms of therelationship between the aforedescribed components and related controlelectronics. In particular, FIG. 5 is an embodiment of a block diagramof autopilot 12. In this regard, main unit 30 comprising enclosure 31,the pitch and roll actuators 60 and electronics 66 may be referred tohereinafter as the Motor Control Processor Unit (MCPU) or main autopilotunit 30. The MCPU includes three microprocessors, each of which may bereferred to as a Motor Control Processor (MCP). There are three MCPs,individually designated as MCP A, MCP B and MCP C. These processor unitseach access a dedicated sensor suite of tri-axial MEMS rate sensors andtri-axial MEMS accelerometers indicated by the reference numbers 142 a,142 b and 142 c, respectively. In the present embodiment, each of thesesensor suites is identically configured. The MCPs are used to provide aninner loop of an overall control system having an inner control loop andan outer control loop. The MCPs provide commands to brushless DC motors,Motor A and Motor B of pitch actuator 60 a and roll actuator 60 b,driving the control system for the helicopter. All inter-processorcommunication can be through a serial bus that is natively supplied oneach of the processors. Data integrity can be protected, for example,through the use of a cyclic redundancy check (CRC) incorporated into thedata stream.

The Federal Aviation Administration certifies airborne system softwareunder a version of DO-178. At the time of this writing, DO-178C has beenreleased. This document specifies Design Assurance Levels (DALs) basedon the criticality of software failure in a given system. For example,DAL A is designated as “catastrophic” and is assigned where a failuremay cause a crash. As another example, DAL C is designated as “major”and is assigned where a failure is significant and may lead to passengerdiscomfort or increased crew workload. In the present embodiment, eachone of the three MCPs can execute identical DAL A software to constitutea triple-redundant system. The motor control processors areinterconnected so that they can share data. Each processor reads itssensor suite and compares its data with sensor data coming from theother two processors for purposes of consistency and each motor controlprocessor computes averages of all the corresponding sensors to use forfurther processing. In another embodiment, median values can bedetermined, as opposed to averages. Sensor data determined to beerroneous is eliminated from having an influence on the median.Generally, detection of a failure of a sensor (as opposed to thepresence of random noise) can be accomplished by subjecting sensor datafrom each of the three sensor suites to low-pass filtering to removenoise. The filtered outputs are compared against one another forconsistency, if one of the filtered results is significantly different(e.g., outside of a predetermined threshold) from the other two results,the sensor associated with the data can be declared to have failed. Rategyro failure detection can be accomplished in a similar fashion with theadditional step of passing the gyro data through wash-out filters priorto the low-pass filters in order to remove bias or drift effects. Onceprocessed through the two filters, the gyro data outputs can be comparedagainst one another for consistency, and any gyro producing an outlyingvalue can be declared to have failed. A warning signal of sound and/orlight can be sent to autopilot display processor unit (ADPU) 28 oninstrument panel 20 (FIG. 1). Haptic feedback such as, for example,stick shaking can be used alone or in combination with other warningsignal indications. In an embodiment, an annunciation section 150 caninclude status lights, best seen in the enlarged inset view of the ADPUin FIG. 1, include green (normal), amber (caution) and red (failure), aswell as dual warning horns to provide system status indications. Thewarning horns also provide system status notifications and alarms alongwith the status lights. Both the status lights and horns interfacedirectly to the MCPs. In some embodiments, sounds and/or warnings can betransmitted over the helicopter audio system such that notifications canbe heard in the pilot's headset as well as being issued from the ADPU.Complementing the status lights and horns is a display which providescurrent autopilot system settings such as engagement status, course,slaved gyroscopic heading, speed over ground and any warning messages.Also on the panel is a testing button which initiates an InitiatedBuilt-In Test (IBIT).

Autopilot 12 can be configured to generate actuator control signalsbased on the set of sensor signals that is used by the MCPs to controlthe flight of the helicopter in a pilot-selected one of a plurality offlight modes. The MCPs can further generate a slaved gyro output signalbased on no more than the same set of sensor outputs. As will be seen,an autopilot display can be configured to display autopilot flight modeinformation to the pilot while displaying a slaved gyro output to thepilot based on the slaved gyro output signal. The autopilot display canbe provided on a single screen, although this is not required, thatsimultaneously displays the autopilot flight mode information and theslaved gyro output. In one embodiment for producing the slaved gyrooutput, the sensor arrangement includes a yaw rate gyro that produces ayaw rate output. The MCPs are configured to integrate the yaw rateoutput to produce a yaw heading. Because the yaw rate gyro can exhibitsignificant drift, especially when a MEMS rate sensor is used, the MCPsperiodically update the yaw heading to compensate for the yaw ratedrift. In an embodiment, the sensor arrangement includes a GPS thatproduces a GPS course and the processing arrangement periodicallyupdates the yaw heading based on the GPS course. In another embodiment,the sensor arrangement includes a magnetometer arrangement that producesa magnetic heading signal and the processing arrangement periodicallyupdates the yaw heading based on the magnetic signal heading.

In another embodiment for producing the slaved gyro output, the sensorarrangement includes a triaxial rate gyro and a triaxial accelerometerand the processing arrangement is configured to generate a helicopterattitude including a yaw heading. The attitude can be determined by aninner loop on an essentially instantaneous basis using the set of sensoroutputs. In one embodiment, attitude can be monitored or tracked by theinner loop based on integration of the outputs of rate sensors. Inanother embodiment, the inner loop can determine the helicopter attitudebased on a direction cosine matrix. The latter can be referred tointerchangeably as a rotation matrix that characterizes one frame ofreference relative to another frame of reference in terms of a rotation.Rate sensor gyro inputs are used as an integration input to determinethe attitude of the helicopter. In this regard, all determinations canbe made in terms of vector cross products and dot products. In stillanother embodiment, quaternions can be used for purposes of determiningthe attitude of the helicopter. In either case, since the determined yawheading is subject to a yaw rate drift that is exhibited by the triaxialrate gyros, the processing arrangement is configured to at leastperiodically adjust the yaw heading to compensate for the yaw rate driftand produce the slaved gyro output. The yaw heading can be periodicallyupdated based on either magnetic heading or GPS course.

The MCPs also read Hall sensor data from the actuator motors, which canbe used to indicate the current position of each actuator, and a commandsignal coming from an autopilot display processor (ADP) which forms partof the ADPU. In this regard, the ADPU serves as the outer control loopto provide command signals to the inner loop. Using all these data, eachMCP calculates a control signal for the motors in terms of a PWM (PulseWidth Modulation) and direction of rotation. Each processor also usesthe Hall sensor data to control the power connections to the armature ofthe brushless motors assigned to it. Each MCP compares its PWM commandsignal and rotation direction for the pitch and roll actuators withcommands generated by the other two MCPs for agreement. Since allprocessors are using the same data to compute motor commands, theyshould produce identical output signals. Signals foragreement/disagreement with the other two processors are sent to avoting section 200 that will disable control input capability of any MCPthat is in disagreement with the other two MCPs. In the presentembodiment, voting section 200 has been implemented in hardware,however, software embodiments can readily be implemented.

Attention is now directed to further details with regard to actuators 60with initial reference to FIG. 3. It should be appreciated that for agear ratio of 1750:1, one revolution of motor A and/or motor B rotatesthe actuator output shaft by only about 0.2 degrees. In and by itself,this resolution can be sufficient for monitoring the actuator outputposition. For example, rotation of the motor shaft can be detected usinga magnet that is mounted on the shaft, as is familiar to one havingordinary skill in the art. In an embodiment, however, Hall sensor datafrom the motors can be used to determine the incremental position of theactuator output shaft of each actuator. In this regard, each actuatormotor includes 3 Hall sensors. The Hall sensor pulses can act like anincremental up/down counter. The position of the arm/output shaftrelative to a reference location can be tracked constantly. For example,a zero reference position of the actuator output shaft can be definedwhen the actuator is engaged via clutch 84. Such zero reference positiontracking can be used for certain failures wherein the best approachresides in restoring the actuator shafts to their averaged positionsprior to the failure. Since each motor includes 3 Hall sensors and 4poles, there are 12 Hall state changes per revolution of each motor.Remarkably, by monitoring the Hall state changes, resolution can beincreased by a factor of 12 such that a resolution of about 0.017degrees is provided at the output shaft of the actuator. In anembodiment, a corresponding movement at the top of the stick in FIG. 1can be about 0.004 inch.

As described above, each actuator includes motor A and motor B. Eachindividual motor is controlled by one MCP. Thus only MCP A and MCP Bcontrol motors. In particular, MCP A controls motor A in each of pitchactuator 60 a and roll actuator 60 b, while MCP B controls motor B ineach of pitch actuator 60 a and roll actuator 60 b. MCP C (the thirdprocessor) does not control a motor but performs all calculations togenerate stick commands as if it were controlling a motor. In thisregard, a third motor can readily be added to each actuator (see FIG. 4)that would engage gear 102 in the same manner as motor A and motor B,but responsive to MCP C. The latter, however, votes in a manner that isidentical to the other two processors. For example, if MCP A and MCP Cagree on the control of the pitch motor, but MCP B does not, then MCP Bwill be voted out from control of its pitch motor, MCP B will stillcontrol its roll motor unless MCP A and MCP C also vote out control ofthat motor. On the other hand, if MCP C is voted out, no actuator motorswill be affected, but a warning light and horn can be actuated as wouldbe the case for the MCPs which control motors. Further details withrespect to this architecture are provided hereinafter.

The actuators are designed such that either one of motor A or motor B isindependently capable of driving the actuator to control the helicopter.The output shaft of a failed motor will be rotated by the remainingmotor. If one of MCP A or MCP B is voted out, the autopilot can continueto function despite the fact that each of these MCPs controls motors. Asstated, there can be a warning light and a brief sounding of the horn tonotify the pilot that there has been a non-critical autopilotmalfunction.

The MCPs have full authority over the controls and are rate limited onlyby the natural response of the system which is about 5 inches persecond. The MCP control section is the only portion of the autopilotthat can create a critical or major hazard malfunction at least in partdue to the rate of stick motion. Accordingly, the MCPU is designed astriple-redundant with DAL A designated software for purposes ofoperating the inner loop of the autopilot. These factors greatly reducethe probability of a critical failure. Applicants recognize, however,that the software corresponding to the outer loop can be partitionedfrom the inner loop software in a way that can allow the outer loopsoftware to be designated at a different design level assurance than theinner loop. In the present embodiment, a lower DAL C certification hasbeen applied to the outer loop software since the latter cannot cause acritical failure. In this regard, the outer control loop retains morelimited authority than the inner loop. That is, the outer loop cancommand only small, rapid actuator motion and slow large actuatormotion. The inner loop, in contrast, can provide rapid changes inresponse to gusts and other sudden changes in attitude while the outerloop changes are designed to hold navigation target parameters and trimrequirements. In this regard, the frequency responses of inner and outercontrol loops are separated from one another such that the two loops donot interact to produce oscillations. That is, even with an outer loopfailure, the helicopter will continue to hold attitude which, withproper warnings from the horn and lights, is a benign failure. Inanother embodiment, the outer loop software, like the inner loopsoftware, can be certified under DAL A. Further, the outer loop of thepresent embodiment includes a lower level of hardware redundancy, aswill be seen.

The outer loop software is handled by the ADP (Autopilot DisplayProcessor) in ADPU 28. The MCPs convert requested autopilot commandsfrom the ADP into actuator control signals that can drive the actuatormotors within defined operational limits. In this regard, it should beappreciated that DAL A software is handled by the triple redundant MCPswhile DAL C, outer loop software is handled by a completely differentprocessor. By way of still further explanation, a single executable runson each MCP. The MCPs, which may be referred to as triplex processors,can execute identical software. Thus, the autopilot control laws arepartitioned between the ADP and triplex processors. The ADP processesthe outer loop dynamics and autopilot modes while the triplex MCPsprocess the inner loop dynamics. Outer loop control laws relate tonavigation functions while inner loop control laws relate to attitudecontrol on an at least essentially instantaneous basis. The ADP furtherprovides the pilot's graphical and testing interface to the autopilotand executes the autopilot control laws to determine actuator commandsbased on sensor and GPS data. Accordingly, this processor interfacesdirectly with a GPS and triaxial magnetometers, and indirectly withtriaxial accelerometers and triaxial rate gyros of the MCPs whichprovide the roll rate, roll attitude, pitch rate, pitch attitude,position, altitude, ground speed, course, yaw rate, accelerations, andheading data. The ADP monitors the health of these sensors but does notcheck the validity of the data. The IBIT test switch also interfaces tothe ADP. In another embodiment yet to be described in detail, the ADPcan be designed in the same manner as the MCPU with triple redundancy.With both the MCPU and ADP in a triple redundancy configuration, theautopilot can tolerate a single failure in either or both units andstill remain fully functional. When a triple redundancy design isemployed in both inner and outer loops, a fail-functional designresults. Therefore, a component in the inner loop such as, for example,an MCP (triplex processor) or the outer loop such as, for example, atriplex ADP processor, can fail and the autopilot will neverthelessremain fully functional.

The MCPs accept data from the ADP which can include commands as well asdata from an external GPS. The data can be screened by each MCP todetect errors or malfunctions. The control command is rate-displacementlimited by the MCPs. The MCPs will not allow a command from the ADP tocreate a hazardous response from the helicopter. GPS data is used by theADP. The GPS and magnetometer data are both used in the MCPs to removedrift errors associated with the rate sensors of each sensor suite andto determine roll, pitch and heading. The GPS data can also be checkedfor errors.

The MCPs constantly monitor for both internal and external faults. Inthe event of an ADP failure, any one MCP can immediately recognize thesituation based on update rate and control signal conformity. Inresponse, the MCPU, in one embodiment, will then cause the inner loop tohold the helicopter straight and level. In another embodiment, the MCPUcan act in the manner of a SAS (Stability Augmentation System) or a deadreckoning system and control the helicopter based on internal ratesignals. The MCPs will attempt to hold attitude and also actuate a hornand light to indicate a failure. It has been empirically demonstratedthat the helicopter can maintain prolonged flight with only MCP control,providing more than ample time for the pilot to take control anddisengage the autopilot. The ability to detect excessive autopilotresponse resides in the triplex motor controllers as detailed herein.The triplex processors monitor sensors and also check to confirm thatcalculated responses are within limits. Pitch and roll commands from theADP are limited based on such command filtering by each of the triplexprocessors. Each triplex processor can detect whether a limit has beenexceeded and can initiate safe shut down of the autopilot. Pitch androll axes commands can be monitored identically but with different limitvalues. The monitors are dynamic; that is, the limit values can befrequency/rate dependent. Redundancy management features for each axiscan include stick rate limiting and body rate monitoring.

Each MCP processor can be provided with an independent power supply. Atotal power failure of the helicopter's electrical power system cancause the actuators to lock in position for about five seconds using adynamic braking feature that is described in detail below. This fivesecond time period is sufficient for the pilot to take over control. Inthis regard, the autopilot does not let the cyclic stick flop over byreleasing control responsive to a power failure to the autopilot. Eventhough the actuators are locked, however, the pilot can still performcontrol over the helicopter since there are override or force limitedlinks 300 a (pitch, seen in FIG. 1) and 300 b (roll, seen in FIGS. 1 and2) between each actuator and the cyclic stick. These links are rigid forforces below an unseating value and compliant at higher forces to allowthe pilot to safely maneuver and land the helicopter even ifdisengagement of the system cannot be achieved. It has been empiricallydemonstrated that a pilot can control the helicopter, including hoveringand landing, with both actuators in what is referred to as a “locked”state. The locked state is provided by shorting all windings of theactuator motors and is used in a dynamic braking embodiment describedbelow. The override links are described in detail in commonly owned U.S.patent application Ser. No. ______ (attorney docket no. HTK-4) whichshares the filing date of the present application and is incorporatedherein by reference. In a helicopter that does not utilize a hydraulicinterface to the cyclic, cyclic vibration isolators 302 a (pitch) and302 b (roll) can be located on the output shaft of each actuator. Thevibration isolators may be optional for use with a helicopter havinghydraulic cyclic control since the hydraulic system generally providesdamping of cyclic oscillations. The vibration isolators reduce the twoper revolution oscillating motion that is present in the R22 rotorcraftcontrol linkage and other light helicopters, to prevent vibratory loadson the rotorcraft control and to increase the fatigue life of theactuator components. The cyclic vibration isolators are described indetail in a separate patent application.

The sensor suite of each MCP can also include memory such as, forexample, EEPROM or other suitable memory, as seen in FIG. 5. If there isan error detected by an MCP during operation, the error code can bestored in the EEPROM of the sensor suite associated with the MCP. TheEEPROM can later be read in the context of determining the cause offailure. The EEPROMs can also contain parameters specific to the modelof the helicopter in which the autopilot is installed such as, forexample, control loop constants, sensor offsets and gains. As anotherexample, the EEPROM can store different parameter sets for operationduring normal hydraulically-assisted cyclic control and for operationresponsive to detection that the hydraulic assistance system has failed.

FIG. 6 is a schematic representation of an embodiment of voting section200 of FIG. 5. It should be appreciated that one having ordinary skillin the art may readily implement a software version based on thehardware configuration that is shown. Main unit electronics 66 (FIGS. 2and 5) includes an individual driver for Motor A and Motor B of eachactuator. In particular, a first driver 600 drives Motor B of rollactuator 60 b, a second driver 602 drives Motor B of pitch actuator 60a, a third motor driver 604 drives Motor A of roll actuator 60 b and afourth motor driver 606 drives Motor A of pitch actuator 60 a. In thisregard, each MCP generates separate commands for pitch and roll that aretargeted for pitch and roll actuators 60 a and 60 b, respectively. Forexample, MCP A delivers pitch actuations to Motor A of actuator 60 a anddelivers roll actuations to Motor A of actuator 60 b. For purposes ofthe present description, a logic high signal on disable inputs 610 ofeach driver (individually designated as 610 a-610 d) will result indisabling that driver, although any suitable logic scheme can beemployed. During normal operation, these drivers operate in a mannerthat will be familiar to those of ordinary skill in the art with respectto driving the armature coils of brushless DC motors in timedcoordination. As will be seen, the status for a given motor isdetermined independently, based on independent pitch and roll voteindications that are cast by the MCPs that do not control the givenmotor.

Still referring to FIG. 6, each motor driver disable input 610 a-610 dis electrically connected to a respective output of one of a set oftwo-input AND gates 614 a-614 d. Further, each AND gate 614 receivesvote indications from the two MCPs that are not associated with theparticular motor driver to which each AND gate is connected. Forexample, AND gate 614 a, which can disable driver 600 for Motor B ofroll actuator 60 b, receives a first roll vote indication from MCP Athat is designated as “MCP A vs B roll vote” to indicate that the voteis cast by MCP A for or against the command generated by MCP B.Similarly, AND gate 614 a receives a second roll vote indication fromMCP C that is designated as “MCP C vs B roll vote” to indicate that thevote is cast by MCP C for or against the command generated by MCP B.Thus, roll votes cast by MCP A and MCP C are individual indications bythese two MCPs as to whether a current roll stick movement command beinggenerated by each of MCP A and MCP C agrees or disagrees with thecurrent roll stick movement command being generated by MCP B. In thepresent implementation, a vote by MCP A or MCP C against or indisagreement with the MCP B roll command is characterized as a highlogic level. If only one of MCP A or MCP C casts a roll control voteagainst MCP B, only one input of AND gate 614 a is logic high such thatthe output of AND gate 614 a remains at logic low, which does notdisable driver 600 to maintain Motor B of actuator 60 b in a normaloperational status. On the other hand, if both MCP A and MCP C cast avote against roll control by MCP B, AND gate 614 a will output a logichigh level that disables motor driver 600 such that Motor B of rollactuator 60 b is deactivated. Control of each of the remaining threemotors is implemented in a manner that is consistent with the foregoingdescriptions, as illustrated by FIG. 6.

Attention is now directed to further details with respect to the innerand outer control loops of the present disclosure. In an embodiment, theinner loop can be configured for providing control of one or moreselected orientation parameters of the helicopter such as, for example,attitude hold including a given level of redundancy and/or softwarecertification (e.g., DAL A) applied to the inner loop. It is noted thatsuch an attitude hold embodiment may be referred to interchangeably as atrue attitude embodiment, as will be further described. The outerautopilot loop can be configured for providing at least one navigationfunction with respect to the flight of the aircraft including adifferent level of redundancy such as, for example, a single processoras compared to the triplex processors of the inner loop and/or softwarecertification such as, for example, DAL C as compared to DAL A for theinner loop. The redundancy and/or certification level applied to theinner loop can be greater than the redundancy and/or certification levelapplied to the outer loop. Based on the teachings that have been broughtto light herein, any suitable combination of mechanical redundancy andsoftware certification can be implemented for the inner and outercontrol loops. In this regard, an embodiment is described in detailbelow which employs triple redundant processing in both the inner andouter control loops. It should be appreciated that the architecture ofthe autopilot embodiments that is described herein provides for upgradesthat can be limited to replacing a less critical portion of the system.For example, ADPU 28 of FIG. 5, in an embodiment, serves as the outerloop and can be certified as DAL C. This ADPU can be replaced orupgraded without affecting the inner loop. For example, an upgrade ADPUcan add additional autopilot navigational modes and/or levels ofhardware redundancy and/or levels of software certification.

FIG. 7 is a flow diagram, generally indicated by the reference number700, which illustrates an embodiment of a method for operating an innerloop 702 and an outer loop 704, as well as interaction between theseloops. The method starts at 710 and proceeds to 712 which reads an ADPcommand that is passed from the outer loop, as will be furtherdescribed. For the moment, it is sufficient to note that an ADP commandis obtained for each iteration though the inner loop. An ADP commandfiltering decision is made at 713 as to whether the ADP command iswithin acceptable limits, for example, as described above. If thecommand is acceptable, operation proceeds to 714. On the other hand, ifthe command is not acceptable, operation proceeds to failure handling716 which can initiate the issuance of warnings and/or shut down theautopilot. At 714, each MCP reads the sensors of its sensor suite (FIG.5) while the ADP reads ADP sensors 718 and GPS 719. At 720, the ADPsensor data is shared with the MCPs. At 722, the MCPs share MCP sensorsuite data (FIG. 5) with one another to form an average set of sensordata that is used by each MCP and which is shared with the ADP. Othersuitable embodiments can determine a median set of sensor data. Further,the MCPs determine an attitude for the helicopter which is also sharedwith the ADP as indicated by a connection 724. At 726, each MCPdetermines actuator motor commands. At 728, voting is performed based onthe commands, for example, using the hardware implementation of FIG. 6or a software equivalent. At 729, the results of voting are compared. Inthe event that there is a processor dispute, operation transfers tofailure handling 716. Any appropriate action can be taken as a failurehandling depending on the voting results. For example, if control hasbeen voted out for one motor of a particular actuator, that motor can bedeactivated, as discussed above. Appropriate warnings can be issued. Ifstep 729 does not identify a voting dispute, operation proceeds to 730,wherein the motors are actuated based on the voting.

Still referring to FIG. 7, attention is now directed to further detailswith regard to the operation of outer loop 704. It is noted that innerloop 702 and outer loop 704 execute in parallel. In this regard, at 740,the outer loop determines an ADP command that is based on the currentflight mode and control laws for the particular rotorcraft in which theautopilot is installed. The control laws and related parameters can becustomized on a per rotorcraft basis. The determination is based, atleast in part, on rate data from the MCPs as well as an attitude for thehelicopter that is generated by step 722 of the inner loop, taken inconjunction with data from ADP sensors 718 and GPS 719. At 760, commandfiltering is applied which serves to limit ADP commands for subsequentuse by the inner loop. The current ADP command, subject to filtering, isthen read by step 712. In this regard, it should be appreciated thatstep 726 applies command limiting to ADP commands, as described above.

FIG. 8 is a schematic diagram of an embodiment of a dynamic brakingsystem, generally indicated by the reference number 800, that can beused, for example, with actuator 60 of FIG. 3. As described above, eachmotor can include a Y-connected stator. In particular, each motorincludes three stator coils, designated as A1-A3 for Motor A and asB1-B3 for Motor B. For purposes of the present discussion, it should benoted that the motors are selected for characteristically exhibiting aresistance to rotation of the drive shaft of the motor in response toshorting or grounding the drive coils. Sets of motor driver lines 802and 804 are connected to appropriate motor drivers, for example, as seenin FIG. 6. Each stator coil is also electrically connected to the drainterminal D of one of a group of six n-channel enhancement mode MOSFETs,individually designated as 806 a-f and which can be referred tocollectively as MOSFETs 806. The source terminal S of each of thesetransistors is connected to a ground 810. Accordingly, a positivevoltage on a gate terminal G of these MOSFETs turns on each MOSFET suchthat the drain to source channel is essentially shorted, so as tofunction as a switch to connect or short the associated stator coil toground. A drive circuit 820 receives input power from the helicopter,which is designated as V_(in), and can comprise battery power from thehelicopter for purposes of powering the autopilot. It should beappreciated that V_(in) should reflect or match any failure of the powersource that provides power to the autopilot. For purposes of drivecircuit 820, the input power for proper operation can range from 9-32volts DC. When power is present, during normal operation of thehelicopter, a zener diode D2 regulates to 9 volts which biases the gateterminal of a p channel depletion mode MOSFET 830 to 9 volts. Currentflows through a diode D1 and a 1K ohm resistor to another zener diode D3which biases a source terminal of MOSFET 830 to 7 volts, also charging acapacitor C1 to 7 volts. Thus, V_(GS) of MOSFET 830 is 2 volts DC suchthat the transistor is biased into an off state. Since MOSFET 830 isoff, the drain terminal of this MOSFET is at zero volts which biases thegate of each of MOSFETs 806 to zero volts such that each of thesetransistors is also off. As will be seen, capacitor C1 acts as a powerstorage device that serves as a dynamic power source responsive tofailure of the power source that provides V_(in).

Still referring to FIG. 8, responsive to a power failure in which Vingoes to zero volts, the gate voltage of MOSFET 830 drops to zero voltswhich turns the transistor on. Once MOSFET 830 is on, it provides adischarge path for capacitor C1 to a 100K ohm resistor R3. Thisdischarge current results in the application of a positive gate voltageto each of MOSFETs 806 such that these transistors turn on, therebyconnecting the stator coils of motors A and B to ground as capacitor C1discharges through R3. Accordingly, MOSFETs 806 will remain on based onan RC time constant that is determined primarily by capacitor C1 andresistor R3. In the present example, the time constant is approximately4.7 seconds. In practice, MOSFETs 806 will remain on for about 4seconds. While this time period can be varied through the selection ofcomponent values, it should be selected to provide for a period of timethat is sufficient for the pilot to take over manual control from theautopilot. Even during the time period during which braking is applied,the pilot is able to take over and maintain control of the helicopterdue to the presence of force limited links 300 a and 300 b, as describedabove and shown in FIGS. 1 and 2. One of ordinary skill in the art willrecognize that the circuit of FIG. 8 can readily be modified and adaptedin view of a particular installation. While the present embodiment hasbeen described in terms of the use of MOSFETs, it should be appreciatedthat other embodiments can employ any suitable type of transistor usingone transistor type or a suitable combination of different types oftransistor types. By way of non-limiting example suitable transistortypes include bipolar, JFET and IGFET among others.

Referring to FIG. 5 in conjunction with FIG. 8, it should be appreciatedthat two instantiations of the circuit of FIG. 8 are utilized. That is,one instance of the circuit of FIG. 8 is connected to the motors of eachof the roll actuator and the pitch actuator. By temporarily shorting themotor coils to ground based on the time constant described above,resistance to rotation of the output shaft of each motor is produced.The degree of resistance is amplified by the gear arrangement of theactuator such that significant force is needed to move the stick fromthe position at which the power failure occurred. Empirical results havedemonstrated that the stick will not flop over as a result of anautopilot power failure while allowing ample time for the pilot to takeover control of the helicopter from the autopilot. It should beappreciated that dynamic braking, as taught herein, can be used with anymotor that exhibits resistance in response to shorting at least selecteddrive coils.

FIG. 9 illustrates another embodiment of a dynamic braking system,generally indicated by the reference number 900, that can be used, forexample, with actuator 60 of FIG. 3. In this embodiment, each motorwinding is connected to one terminal of a normally closed contact,individually designated as NC₁, NC₂ and NC₃. The opposite terminal ofeach NC contact is connected to ground 810. Each of a first relay 902and a second relay 904 includes a relay coil that is driven by Vin.While the present example illustrates the use of a 3 pole, single throwrelay (having only normally closed contacts) in association with eachmotor, it should be appreciated that any suitable type of relay can beused. During normal operation, Vin is applied to each relay coil suchthat the normally closed contacts are in an open condition. If Vin islost, however, the normally closed contacts close to connect each statorcoil to ground thereby applying dynamic braking, as described above.Since the motors remain in a braked condition responsive to powerfailure, the pilot is able to take over and operate the helicopter dueto the presence of force limited links 300 a and 300 b, as describedabove and shown in FIGS. 1 and 2.

While the above described dynamic braking embodiments have been framedin the context of applying braking forces to the cyclic, it should beappreciated that braking forces can be applied to any suitable controllinkage to which an actuator motor is mechanically coupled withoutlimitation. For example, dynamic braking can be applied to the tailrotor pedals of the helicopter. As another example, dynamic braking canbe applied to the collective control. Further, some embodiments canemploy dynamic braking without utilizing the actuator as part of anautopilot system.

Attention is now directed to FIG. 10 which is a block diagram thatillustrates another embodiment of the autopilot of the presentdisclosure, generally indicated by the reference number 1000. To theextent that autopilot 1000 corresponds to previously described autopilot12 of FIG. 5, descriptions of like components will not be repeated forpurposes of brevity. The primary distinction with respect to autopilot1000 resides in the provision of triplex ADP processing sections, aspart of ADPU 28′, that are designated by the reference numbers 1002,1004 and 1006. MCPU 30′ still includes triplex processors/MCPs butinstead is configured to cooperate with the triplex ADPs. Each triplexADP processing section includes a dedicated sensor suite designated as1010, 1012 and 1014, respectively. Like the ADP processing section ofFIG. 5, the triplex ADPs operate based on control laws, for example,relating to navigational modes, while the MCPs handle control lawsrelating to instantaneous attitude control in a way that cooperates withthe triplex ADPs to accomplish the various navigational control modes.In the present embodiment, each sensor suite includes a triaxialmagnetometer. Further, in the present embodiment, each triplexprocessing section receives GPS inputs from a dedicated GPS unit. Inother embodiments, two GPS units can be used in combination with othersuitable data sources providing data such as, for example, airspeed andpressure-based altitude. In this regard, embodiments can accept commandsfrom another navigation unit. Such commands can include, for example,roll and steering commands. In some embodiments, three or more GPS unitscan be utilized. In still another embodiment, a single GPS unit can beused in conjunction with other sensors for purposes of providingredundancy. By way of non-limiting example, by sensing static pressurefor pressure-based altitude, the latter can be used in place of GPSaltitude from a second, redundant GPS. For purposes of controllingannunciation section 150, an annunciation voting section 1020 can beprovided which can include dual warning horns; a green, normal lamp; anamber, caution lamp and a red, failure lamp. Voting section 1020, in amanner that resembles previously described voting section 200 of FIG. 5with respect to MCP motor control, can vote out annunciation control byany one of the triplex processors/MCPs that disagrees with the other twotriplex processors. Each triplex ADP is in dedicated data communicationwith a respective MCP such that each MCP receives control commands fromone ADP for purposes of that MCP generating motor control signals. EachADP and MCP pair can operate in accordance with the flow diagram of FIG.7. In this way, the ADP command generated by each ADP influences themotor control signal of its associated MCP such that an MCP that isassociated with a failed ADP will be voted out of motor control, asdescribed above. Of course, triplex ADP C does not serve in a motorcontrol capacity, as described above, in being associated with MCP C,but serves to cast votes for comparative purposes. In anotherembodiment, voting section 200 can operate on votes that are cast by theADPs which are generated in like manner to the votes that are producedby the MCPs, as described above. Based on the discussions above, itshould be appreciated that the embodiment of FIG. 10 can be consideredas having a fault tolerance that is fail-functional. That is theauto-pilot remains fully functional, for example, despite a completefailure of any one triplex ADP processor or any one triplex MCPprocessor. Of course, warnings can be issued to indicate the presence ofthe failure to the pilot, however, the autopilot can continue operatingwithout the need for pilot intervention.

While the discussions above describe embodiments of an inner controlloop in detail which provides an attitude hold or true attitude functionthat provides for recovery from unusual attitudes on engagement, itshould be appreciated that the inner control loop can be configureddifferently in other embodiments. For example, in another embodiment theinner control loop can be rate based. In such an embodiment, the innercontrol loop attempts to hold rates to zero. That is, a rate based innercontrol loop attempts to hold a current attitude of the helicopter atleast somewhat constant, whatever the current attitude might be, at thetime of engagement of the autopilot. In such an embodiment, it is notnecessary for the inner loop to correct for the drift of the ratesensors in the MCPs beyond, for example, washout filters which removebias errors. Therefore, the current attitude is maintained as at leastsomewhat constant in being subject to the drift of the rate sensors. Therate gyro drift can result in a change in track and pitch. Inparticular, the pitch drift can impact the altitude hold and speed holdmodes while the roll drift and yaw drift can impact the track. In thisregard, however, the outer control loop, as described above, cancompensate for and make the gradual necessary changes to correctattitude drift errors in the same manner as if the errors were caused,for example, by long term wind changes. For this reason, there is norequirement in this embodiment for sensors such as a triaxialaccelerometer in the inner control loop to provide corrections for driftsince only the rate gyro sensing is needed. That is, the MCP sensorsuites shown in FIG. 5 do not require triaxial accelerometers. It shouldbe remembered, however, that a rate based inner control loop does notdetermine the actual or true attitude of the helicopter and, therefore,cannot provide for reliable recovery from an unusual attitude at thetime of engagement. The term “true attitude” as used herein is intendedto encompass techniques that fully characterize the attitude of theaircraft, at least to an approximation, that can be subject tounavoidable error such as, by way of non-limiting example, measurementinaccuracies.

Still describing details of a rate based inner control loop embodiment,the inner control loop/outer control loop structure described above canbe retained. The accelerometers previously described for the inner loop(FIGS. 5 and 10) can be moved to the outer loop and, in an embodiment,can also be reduced to just a single axis for load (G) monitoring. Themagnetometers remain as parts of the outer control loop in a rate basedsystem. Because the rate gyro drift is indistinguishable from winddrift, the outer loop control laws can accommodate the drift in the samemanner. In an embodiment that does not require an actual heading as aninput, there can be no need for magnetometers in the ADPU, particularlywhen a GPS is incorporated that provides a track output. As discussedabove, the inner control loop retains full authority and is rate limitedonly by the system response. During operation, the inner loop issuescontrol signals that are necessary to hold down the rates foressentially instantaneous changes in attitude. The outer control loopretains more limited authority in that it can command only small rapidactuator motion and slow large actuator motion. Like the attitude holdembodiment, partitioning of functionality between the inner and outercontrol loops provides for the use of differing reliability and/or DALsoftware in the two loops.

Attention is now directed to FIG. 11 which is a chart that illustratessix operational modes of the autopilot of the present disclosure versussensor signals and values that are employed by each mode. The chart ofFIG. 11 describes 6 autopilot modes with respect to “Inner Loop” and“Outer Loop” column headings. The inner loop column heading includessub-columns that are set out in order as “Mode”, “Title” whichdesignates the name of each mode, “Rates” which designates the axesabout which particular rate gyro signals are measured, “Accels” whichdesignates the axes along which particular accelerometer signals aremeasured, “Course” which designates a course or path over the ground,“Lat/Lon” which is a GPS position signal including latitude andlongitude, “Speed” which designates a GPS-based speed or aircraftsensor-based speed, and “Mag” which designates the particular axes alongwhich magnetometer readings are measured. The outer loop column headingincludes the same sub-columns as the inner loop column heading with theaddition of “Alt” which is an altitude reading that can be GPS-based orcan be determined by a pressure sensitive instrument and “Attitude”which is the true attitude determined by the inner control loop.

Mode 1 is a rate based course and speed hold mode which utilizes a MEMSroll rate signal, a MEMS pitch rate signal and a vertical accelerometerfor the inner loop. The vertical axis accelerometer can be used in anymode to ensure that helicopter load limits are not violated. That is,maneuvers which would produce a low-g condition for helicopter having a2-blade rotor can be avoided as well as maneuvers that could produce ahigh g condition exceeding structural limits of the helicopter The outerloop for mode 1 uses GPS course, a MEMS yaw rate signal, as well as thepitch rate and vertical accelerometer signals. A speed signal can betaken from the GPS or provided by an aircraft airspeed sensor, as is thecase for any mode. In some embodiments, the outer loop for mode 1 canemploy GPS information in place of the pitch and/or yaw rate signals.

Mode 2 is a rate based course and altitude hold mode which utilizes aMEMS roll rate signal, a MEMS pitch rate signal and a verticalaccelerometer for the inner loop. The outer loop for mode 2 can use thesame signals as the outer loop for mode 1 with the addition of analtitude signal. The altitude signal can be GPS-based or obtained from apressure-based altitude sensor.

Mode 3 is a rate based hover/position hold mode that utilizes a MEMSroll rate signal, a pitch MEMS rate signal and a vertical accelerometerfor the inner loop. The outer loop for mode 3 can use the same signalsas the outer loop for mode 1 with the addition of a MEMS yaw rate signaland a GPS position signal that provides latitude and longitude. Analtitude signal is not required since this mode does not controlaltitude in the present embodiment. It should be appreciated, however,that an altitude signal can be employed for purposes of indicating thecurrent altitude to the pilot and/or to indicate a change from a desiredaltitude to the pilot. Horizontal magnetometer signals, which can beoriented along the rotorcraft pitch and roll axes, are also employed.

Mode 4 is a true attitude course and speed hold mode that utilizes atriaxial MEMS rate sensor, a MEMS triaxial accelerometer and a triaxialmagnetometer for the inner loop. The latter further utilizes a GPScourse signal and can use a GPS speed signal. In another embodiment, thespeed signal can be provided by an aircraft airspeed sensor. The outerloop for mode 4 uses GPS course, as well as the pitch and yaw ratesignals, the vertical accelerometer signal, the inner loop's estimationof aircraft attitude and the speed signal. In some embodiments, theouter loop for mode 4 can employ GPS information in place of the pitchand/or yaw rate signals, and/or the aircraft attitude estimate.

Mode 5 is a true attitude course and altitude hold mode that utilizes atriaxial MEMS rate sensor, a MEMS triaxial accelerometer and a triaxialmagnetometer for the inner loop. The latter further utilizes a GPScourse signal and can use a GPS speed signal. In another embodiment, thespeed signal can be provided by an aircraft airspeed sensor. The outerloop for mode 5 uses the same signals as the outer loop of mode 4 withthe addition of GPS or pressure-based altitude. In some embodiments, theouter loop for mode 5 can employ GPS information in place of the pitchand/or yaw rate signals, and/or the aircraft attitude estimate.

Mode 6 is a true attitude hover/position hold mode that utilizes atriaxial MEMS rate sensor, a MEMS triaxial accelerometer and a triaxialmagnetometer for the inner loop. The latter further utilizes a GPScourse signal and can use a GPS speed signal. In another embodiment, thespeed signal can be provided by an aircraft airspeed sensor. The outerloop for mode 6 uses the same signals as the outer loop of mode 4 withthe addition of the yaw rate signal and a GPS position signal thatprovides latitude and longitude. In some embodiments, the outer loop formode 6 can employ GPS information in place of the pitch, yaw, and/orroll rate signals and/or the aircraft attitude estimate.

The foregoing description of the invention has been presented forpurposes of illustration and description. It is not intended to beexhaustive or to limit the invention to the precise form or formsdisclosed. For example, a second instantiation of the autopilot of thepresent disclosure in a particular installation can provide control ofthe collective and the tail rotor pedals with the appropriate software.Thus, full autopilot control can be implemented using a “first”autopilot, as described above and a “second” autopilot that managesother flight controls. This modified/dual autopilot system includes fourindependent actuator drive shafts and can provide an operational mode inwhich speed and altitude are both held and/or another operational modein which descent/ascent rate and speed are both held with no pilotcontrol inputs. Generally, in such an embodiment, the inner loop of thesecond autopilot can manage side slipping using a pedal actuator andhold altitude constant using a collective actuator. Since the inner loopof the first auto-pilot, as described above, can hold pitch constant,airspeed can be held constant via pitch management. Given thisconfiguration, the second autopilot can manage altitude using thecollective actuator. For collective control inputs, altitude hold orascent/descent rate requirements can be based on GPS or pressure data,for example, in outer loop control modes that manage flying approachesor VNAV (Vertical Navigation) where there is a vertical navigation speedrequirement. Accordingly, other modifications and variations may bepossible in light of the above teachings wherein those of skill in theart will recognize certain modifications, permutations, additions andsub-combinations thereof.

What is claimed is:
 1. An autopilot system for a helicopter, saidautopilot system comprising: an inner control loop that includes a fullcontrol authority over the helicopter stick, said full control authoritybeing limited only by the natural response of the autopilot system, andis configured at least to provide an actual attitude estimate for theflight of the helicopter including a given level of redundancy appliedto the inner loop; and an outer control, autopilot loop that includesless than the full control authority and is configured to provide atleast one navigation function with respect to the flight of thehelicopter including a different level of redundancy than the innerloop, wherein said different level of redundancy of the inner loop isgreater than the given level of redundancy of the outer loop.
 2. Theautopilot system of claim 1, wherein the frequency responses of theinner and outer control loops are separated from one another such thatthe two loops do not interact to produce oscillations.
 3. The autopilotsystem of claim 1 wherein the inner loop is configured with triplexprocessors for triple redundancy in the inner loop.
 4. The autopilotsystem of claim 3 wherein the inner loop is further configured such thatthe triplex processors each simultaneously generate a motor controlsignal.
 5. The autopilot system of claim 4 wherein the inner loop isconfigured to receive a control command from the outer loop on eachiteration of the inner loop as part of generating the motor controlsignal of each triplex processor.
 6. The autopilot system of claim 5wherein the outer loop is configured to perform one-for-one iterationwith the inner loop.
 7. The autopilot system of claim 4 wherein eachtriplex processor is configured to compare the motor control signal thatis generated by that triplex processor to the motor control signal thatis generated by each of the other two triplex processors and, based onthe comparison, to cast a first vote for or against a first one of theother two triplex processors and a second vote for or against a secondone of the other two triplex processors.
 8. The autopilot system ofclaim 7 wherein first and second ones of the triplex processors are eachin control communication with at least one actuator motor and a thirdtriplex processor generates said motor control signal and casts saidvotes but the third triplex processor is not in control communicationwith an actuator motor.
 9. The autopilot system of claim 7 including avoting manager that disables motor control signal influence for anyparticular one of the triplex processors when the votes of both of theother two triplex processors are against the particular triplexprocessor to indicate a failure thereof.
 10. The autopilot system ofclaim 9 wherein the inner loop and the outer loop remain fullyoperational responsive to a failure of a single one of the triplexprocessors.
 11. The autopilot system of claim 4 including a pitchactuator and a roll actuator to apply pitch actuations and rollactuations, respectively, to a control linkage of the helicopter andeach of which actuators includes a redundant electric motor set at leastincluding a first motor and a second motor, and a first triplexprocessor generates first processor motor control signals to control thefirst motor of the pitch actuator and the first motor of the rollactuator and a second triplex processor generates second processor motorcontrol signals that control the second motor of the pitch actuator andthe second motor of the roll actuator.
 12. The autopilot system of claim1 wherein the inner loop is configured with triplex processors fortriple redundancy in the inner loop and further comprising a set oftriplex sensor suites such that each triplex processor reads one of thesensor suites that is dedicated to that triplex processor to producesensor data.
 13. The autopilot system of claim 12 wherein each triplexprocessor is configured to share the sensor data from a dedicated one ofthe sensor suites with the other two triplex processors.
 14. Theautopilot system of claim 1 wherein the outer loop is configured tooperate based on a set of control laws for a particular helicopter. 15.Theautopilot system of claim 1 wherein said helicopter includes a cycliccontrol and wherein the system further comprises an actuator arrangementto actuate the cyclic control to provide said attitude hold and saidnavigation function.